Elasticsearch subject to cross site scripting

published 2018-09-19 8 y ago modified 2026-06-17 4 mo ago also GHSA-mjpc-qx7h-r8c9 , EUVD-2022-4583

cvss: 6.1; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 0; none known

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.

Patch / fix

fixed in 4

maven org.elasticsearch:elasticsearch 5.6.9, 6.2.4
elastic elasticsearch_x-pack 5.6.9, 6.2.4
elastic kibana_x-pack 5.6.9, 6.2.4
elastic logstash_x-pack 5.6.9, 6.2.4

Exploit prediction

0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	6.1	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub	3.0	6.1	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.elasticsearch:elasticsearch	<5.6.9 >=6.0.0, <6.2.4	5.6.9 6.2.4

Affected products

Elastic Elasticsearch X-Pack Machine Learning

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

discuss.elastic.co /t/elastic-stack-6-2-4-and-5-6-9-security-update/128422
web, vendor-advisory
elastic.co /community/security
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2018-3824
advisory

Sources

CVE List CVE-2018-3824
GitHub Advisory GHSA-mjpc-qx7h-r8c9
NVD CVE-2018-3824

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary